S [^iTy 


Experimental  Studies  of  Vulnerabilities 
in  Devices  and  On-Chip  Protection 


Agis  A.  Iliadis 

Electrical  and  Computer  Engineering  Department 
University  of  Maryland,  College  Park,  MD  20742 
Tel:301-405-365 l/agis@eng.  umd.  edu 

Research  Students:  Xingzhi  Wen,  KyechongKim,  Kai  Zhang 

Collaboration:  J.  Rodgers,  Y.  Carmel,  T.  Firestone 

Interaction:  Antonsen,  Baker,  Goldsman,  Jacob,  Melngailis,  Ott,  Ramahi 

Acknowledgements:  Support  by  the  AFOSR-MURI  Program  is  gratefully 
acknowledged 


6/8/02 


Report  Documentation  Page 

Form  Approved 

OMB  No.  0704-0188 

Public  reporting  burden  for  the  collection  of  information  is  estimated  to  average  1  hour  per  response,  including  the  time  for  reviewing  instructions,  searching  existing  data  sources,  gathering  and 
maintaining  the  data  needed,  and  completing  and  reviewing  the  collection  of  information.  Send  comments  regarding  this  burden  estimate  or  any  other  aspect  of  this  collection  of  information, 
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Introduction 


si 


•  Study  effects  on  the  fundamental  units  of  IC  circuits,  ie 
individual  devices  (MOSFETs)  and  gates  (CMOS  Inverters). 

•  Identify  most  prominent  vulnerabilities  of  the  units  to  RF 
direct  injection  and  irradiation,  and  examine  how  they 
critically  affect  circuit  operation. 

•  Establish  the  failure  mechanisms  for  each  regime  and  develop 
hardened  IC  device/circuit  designs. 

•  Evaluate  response  of  device  with  RF  pulse  parameters  and  use 
MOSFET  devices  as  on-chip  sensing  and  protecting  elements. 

•  Develop  on-chip  sensing,  registration,  and  protection  circuitry. 

•  Develop  protective  nano-composite  polymer  based  “spin-on” 
coatings. 


Approach 


•  Assume  RF  signals  couple  to  devices  through  1/0/antenna  ports, 
and  neglect  bouncing  signals  within  the  packaged  chip. 

•  Chips  containing  several  individual  enhancement  mode  N-channel 
MOSFETs  of  varying  dimensions  were  fabricated  and  packaged  in 
transistor  headers  for  testing  under  RF. 

•  PC  Boards  were  designed  and  fabricated  and  the  packaged  chips 
were  placed  on  the  boards  with  matching  elements  for  RF  injection. 

•  The  RF  vulnerabilities  are  examined  both  by  simulation  and 
experimental  injection  of  RF  at  the  MOSFETGate,  Drain,  Source, 
and  Body. 

•  The  On-Chip  "Sense-and-Protect"  circuit  is  being  developed. 
Several  prototypes  have  been  fabricated  and  tested. 


Outline 


•  MOSFET  1C  Chip  and  Packaging 

•  MOSFET  simulation  of  RF  injection  using  P-SPICE  and 
MEDICI 

•  Two  cases:  a.  dc  operational  point  upset  and  b.  upset 
with  legitimate  small  ac  signal  at  input 

•  Experimental  RF  injection  in  packaged  devices 

•  On-chip  "Sense-and-Protect"  development  and  test 

•  Summary 

•  Continuing  Work 

•  Future-Goals 


1C  Chip  with  Individual  MOSFETs 


•  IC  Chip  with 
Enhancement-Mode  n- 
channel  MOSFETs 

•  Gate  Length  varies 
between  2um-20um. 

•  Parameters  affected: 

•  Electronic:  I-V,  Q  point, 
gm,  gain,  delay  times,  ft, 
fm,  s,  impedences 

•  Physical:  Gate  oxide, 
junction  boundaries, 
metallizations. 


Packaged  Chip  for  RF  Test 
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•  Bonded  and  packaged 
IC  Chip 

•  Several  devices  are 
wire-bonded  for  RF 
testing 

•  Operating 
conditions  :VDD=5  V 

•  Packaged  chip  is 
placed  on  PC  board 
for  RF  test 


Family  of  l-V  Output  Characteristics 
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•  Typical  dc  I-V 
characteristic  of  a 
MOSFET 

•  Operating  point 
at  Vds=7V  and 
Vgs=2.5V 


Simulation  using  P-SPICE 


DC  Biased  Circuit 


Circuit  for  P-SPICE  simulation  using  a  T  junction  for  RF  injection. 

RF  amplitude:  1  and  4  V. 

RF  frequencies  :  20MHz,  100MHz,  500MHz,  2GHz,  &  20GHz. 


500MHz  RF  Injection  to  Gate 


Idrf  +  AIdrf 
Where  : 

ID  :  DC  bias 
current 

AIdrf  •  increase  of 
drain  current  due 
to  RF  injection 


Family  of  I-V  characteristics  at  DC  and  500  MHz  for  sinusoid  RF.  The  DC 
gate  bias  per  characteristic  is  at  VGS=2  V  and  W/L=10/5 


ID  (mA) 


RF  Injection  to  Gate,  Drain 


RF  INJECTION  TO  GATE 


Gate  Drain 

AIDRf  vs  RF  Frequency  and  amplitude.  RF  amplitude  from  IV  to  10V  and 
frequency  from  DC  to  10GHz.  VGS  =  5V,  VDS=7V. 


Magnitude  of  effective  impedance  with 

injected  RF  frequency 


The  magnitude  of  impedance  looking  into  Gate,  Drain,  and  Source  is  decreasing 

with  RF  frequency. 


Distancs  (Microns) 

0.60  0.40  0 □ 20  0.00 


Simulation  with  both  input  signal  and 
injection  using  MEDICI-Avanti 


0.5  Micron  N-MOSFET 


0.00  0.20  0.40  0.60  0.80  1.00  1.20  1.40 

Distance  (Microns)  =  0.2sill(l  O^Ttt),  fl  lOOMHZ 

•Vgs  =  2.5  V 

•  VRF  =  IV,  3  V,  5V. 

RF  pulses:  500MHz,  1GHz 


I  (FNMOS.  Drain)  (Amps)  1  □  t  -  4 
.00  1.00  2.  00  3. 00 


Small  signal  at  gate  and  RF  Injected 

at  Body  (Substrate) 


Drain  Current  Drain  Voltage 

Input  signal  at  gate  is  100  MHz  sinusoid.  Output  waveforms 
modulated  by  RF  pulsed  injection  at  the  Body.  Similar  modulation 
is  observed  for  RF  injection  at  the  Source.  RF:  1  GHz,  3V 


Device  Under  Test  (DUT)  on  PC  Board 


Circuit  Diagram  of  the  MOSFET  RF 

Test  Device 


Circuit  diagram  of  device  under  test  (DUT).  Device  is  in  IC  package  and 
package  is  soldered  onto  PC  board  and  in  aluminum  box.  Matching 

components  are  shown. 


W/O  RF: 
Vds=5.552V 
Id  =  269uA 


RF  injection  at  Gate 
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With  RF  injected 
(200MHz,  2.4  V) 

Vds=5.051V 
Id  =  305uA 

Id=36uA(13%) 


Upper  line:  experimental  output  voltage  (Vds)  vs  time  with  RF  showing 
the  dc  average  output  voltage  at  the  drain  is  reduced  by  13% 


Id  increase  due  to  RF  injection  at  Gate 


Equivalent  Id 
increase  with 
amplitude  of  RF 
injection  signal  at 
gate 


l-V  Characteristic 


0.4 


Vds(V) 


Id  increase  due  to  non-linearity? 


I-V  Characterstic  of  the  MOSFET 
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l.3e-5 


/l  =  1.3e-3 


- Vt)2(l  +  AVds ) 

Vt=  -0.96 
W/L=5 


Device  test  for  non-linearity 


Tek  Run:  2.50GS/5  Sam  Die 
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Upper  curve  is  Vgs,  lower  curve  is  Vds  (with  RF).  RF  lowers 
the  drain  voltage  and  increased  the  drain  current. 


Simulation  result  for  non-linearity 
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Measurement: 

Vds:  6.07V  -»  4.45V 
Simulation: 

S 

Vds:  4.71V  3.57V  | 

Measurement  and 
simulation  show 
similar  trend 

'0  200  400  600  800  1000 

Time(ps) 


Simulation  result 


Sense  and  Protect” 


Sense  element  based  on 
“floating  gate”  MOSFETs  of 
different  size  and  geometries. 

Protection  based  on 
comparators  and  fast  switches. 

Efficient  disconnect  capability 
with  minimal  coupling  to  the 
rest  of  circuit  in  the  off-state 

Designed  for  wide  frequency 
and  amplitude  range  of  events 

It  registers  RF  events 

Patent  Pending 


Circuit  Concept 


Schematic  of  Protection  System 


"Sense-and-protect"  chip  test 
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Legitimate  input 
signal: 

Amplitude:  200mV 

Output  signal: 

amplitude:  280mV 
(Gain:  1.4) 

•Phase  shift:0 


Upper  curve  is  input,  lower  curve  is  output 

from  S-P  chip 


"Sense-and-Protect"  RF  Blocking 
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TeK  Run:  lOOMS/s  Sample 

i - - - 


RF  Input  signal:  f~10  MHz,  2V 
Output :  0.5V 


Expected 

Response 


0  0.5  1.0 

time, ms 


Upper  curve  is  input,  lower  curve  is  output  from  S-P  chip.  Inset 
on  right  is  the  expected  response  for  blocking  RF. 


Summary 


•  Simulated  and  experimental  RF  injection  on  MOSFETs  at  the 
gate,  showed  an  increase  in  the  drain  current  possibly  due  to  the 
non-linearity  in  I-V  characteristics. 

•  This  drain  current  change  appears  to  decrease  with  increasing  RF 
frequency 

•  RF  injection  at  the  drain  appears  to  reduce  drain  current  probably 
due  to  non-ideal  output  conductance  effects 

•  RF  injection  at  body  and  source  modulates  and  distorts  legitimate 
input  signals 

•  The  non-linearities  in  I-V  output  characteristics  (quadratic,  output 
conductance,  break-down)  are  some  main  factors 

•  On-chip  “Sense-and-Protect”  circuit  was  tested.  All  sections  were 
tested  and  found  to  operate  as  designed,  except  for  the  switching 
elements  that  did  not  fully  switched  off  thus  a  20%  signal  pass¬ 
through. 


Summary-Continuing  Work 
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•  Improvements  in  the  design  and  fabrication  of  the  switches 
and  an  additional  circuit  to  avoid  disruption  of  the  operation 
while  blocking  the  RF  signal,  are  being  implemented. 

•  The  “sense-and-protect”  circuit  will  also  be  scaled  down  to 
submicron  gate  lengths  for  faster  response  and  higher  RF 
frequencies  and  implemented  with  “wide”  gates  designed  to 
effectively  collect  RF  radiation  as  antennas  and  register  each 
RF  event  to  help  with  the  understanding  of  radiation 
distribution  within  the  packaging  (Antonsen,  Ott,  Ramahi). 

•  It  will  then  be  incorporated  in  the  design  of  the  main 
communication  chip  (Goldsman,  Jacob,  Melngailis,  Baker)  to 
protect  and  register  RF  events  at  the  I/O  points  of  the  chip. 

•  Direct  RF  radiation  experiments  are  underway  to  establish 
vulnerabilities  in  the  devices  and  map  their  dc  and  ac 
characteristics  with  RF  amplitude  and  frequency. 


Summary-Future  Goals 


1! 


•  We  have  begun  to  experiment  with  protective  coatings  on 
polymers  intended  to  completely  shield  the  chips  from 
radiation  by  developing  a  “spin-on”  polymer  and  nano¬ 
composite  metal  system. 

•  Our  overall  approach  is  to  develop  the  understanding  of  how 
the  unit  cells  of  IC  circuits  in  analog  and  digital  mode  react 
to  RF  radiation,  map  the  vulnerabilities,  develop  protection 
on  the  chip  level,  and  (re)design  devices  to  harden  against 


RF. 


•  Develop  active  shielding  within  chip  environment  to  disrupt 
radiation  patterns. 


